metavida

They mention terminal passwords on their privacy page (short story, they don't read passwords if they aren't echoed on the terminal)

The ability to exclude files that I know contain sensitive data would be a very nice step. Even better if you explicitly state that retroactively excluding files will result in a deletion of the file from your servers.

A few of my friends found multiple copies of ssh_config lying around, so I wrote this one-liner that looks at 3 separate known ssh_config files & patches any vulnerable ones that it finds.

$ for SSH_CONF in /etc/ssh/ssh_config /etc/ssh_config /private/etc/ssh_config; do [ -f $SSH_CONF ] && ! grep -q 'UseRoaming no' $SSH_CONF && echo "Patching $SSH_CONF" && echo -e '\nHost *\n UseRoaming no' | sudo tee -a $SSH_CONF > /dev/null; done

I'd say nearly every move the CAH folks make is some form of nontraditional marketing. Sure, buying an island may seem like just throwing away profit, but the amount of buzz and fan loyalty generated by that sort of stunt is a big part of what keeps their brand relevant & growing.

> I see no actionable suggestions for how to solve the problem

Here are a few actionable suggestions from OP's article:

    * "[Create] a Code of Conduct for Hacker News." This helps all community members share clear expectations of appropriate & inappropriate behavior.
    * "After providing clear guidance for what kinds of comments are acceptable to its values, YC must fund a means of consistent enforcement when content is posted outside those bounds."
    * "[YC] must publicly accept its complicity in building and maintaining a business asset with these negative externalities."
    * "YC must submit to accountability for improvement."

From the "How can visitors connect?" page:

> Visitors who are XFINITY Internet subscribers can simply select the XFINITY WiFi network “xfinitywifi” on their device and open a Web browser to get started. They will be able to sign in with their XFINITY email or username and password.

So now anyone can create a hotspot named "xfinitywifi" and phish for passwords from folks who doesn't look for an https connection. I hope Comcast does some good training beyond "connect and enter your password."

Seems like making the calculation of Hash2 computationally expensive places more burden on the application than it does on a hacker trying to compute plain-text passwords. The app has to work twice as hard to verify (e.g. scryptX2) while to brute force you only really need to match Hash1. To keep latency down this might encourage use of weaker hashing for Hash1 which seems bad.

Of course you could seed your hashes table with false positive matches (perhaps from the list of the top 10,000 passwords), in an attempt to force a hacker to calculate the second hash, but that doesn't seem like a strong defense.